Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 433
Alerts This Week
Warning Icon 1 433

Ubuntu 18.04 LTS: USN-5079-3 Critical Curl Denial Of Service Fix

ubuntu
Calendar Grey September 21, 2021
Dist Ubuntu Esm H88
Resolving curl problems in Ubuntu 18.04 LTS alongside USN-5079-3 updates aimed at enhancing security and performance.
USN-5079-1 introduced a regression in curl.

Summary

USN-5079-1 introduced a regression in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

USN-5079-1 fixed vulnerabilities in curl. One of the fixes introduced a

regression on Ubuntu 18.04 LTS. This update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

It was discovered that curl incorrect handled memory when sending data to

an MQTT server. A remote attacker could use this issue to cause curl to

crash, resulting in a denial of service, or possibly execute arbitrary

code. (CVE-2021-22945)

Patrick Monnerat discovered that curl incorrectly handled upgrades to TLS.

When receiving certain responses from servers, curl would continue without

TLS even when the option to require a successful upgrade to TLS was

specified. (CVE-2021-22946)

Patrick Monnerat discovered that curl incorrectly handled responses

received before STARTTLS. A remote attacker could possibly use this is...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory update critical DoS Ubuntu curl memory handling

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
  curl                            7.58.0-2ubuntu3.16
  libcurl3-gnutls                 7.58.0-2ubuntu3.16
  libcurl3-nss                    7.58.0-2ubuntu3.16
  libcurl4                        7.58.0-2ubuntu3.16

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5079-3

https://ubuntu.com/security/notices/USN-5079-1

https://bugs.launchpad.net/ubuntu/+source/curl/+bug/1944120

Severity
critical
Lowest
Low
Medium
High
Critical

September 21, 2021

Topics%20covered

Topics Covered

security advisory update critical DoS Ubuntu curl memory handling

Package Information

https://launchpad.net/ubuntu/+source/curl/7.58.0-2ubuntu3.16

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.